AI agents expose limits of traditional identity governance

Consider the case of olive oil. A high-quality bottle of extra virgin olive oil from Italy or Spain can be costly. Because it’s high quality, one might want to savor it and may believe that its pedigree means it will last longer. But the truth is, once opened, the best olive oil is best consumed within three to four months, if it is to retain its full flavor and nutritional benefits. If left for more than six months, it will likely go rancid.

We think all the time about perishable foodstuffs – less so about perishable identity governance structures. But just as a bottle of Grand Cru Tenuta Macchia di Rose will lose its impact as it reacts to its environment, identity governance models deployed ten years ago are no longer effective in reacting to a digital ecosystem that is now more machine than human.

A recent webinar from RSA explores this conundrum. The key culprit and root cause is scale – the expansion and acceleration of activity enabled by AI. Nathan Pinder, a senior advisor at RSA, says “the volume of identity and entitlements and access events in a modern enterprise has simply outpaced what any sort of human-driven review process is going to be able to handle.”

In this context, Christopher Williams, director and field CTO for RSA governance and lifecycle, speaks of the problem with review cycles and audits that represent a point in time. Every certified review, he says, starts expiring the moment it closes – so-called “audit decay.” That leaves a negligence gap – a period of “undetected drift” in which breaches can occur. Audit data, so to speak, goes stale quickly. That means clean compliance results don’t equal actual security.

According to the RSA, the solution is also to be found in embracing AI as a defense mechanism.

In cloud-native environments, agents outnumber humans 144:1

The numbers give perspective to how dominant agentic AI has become. Information systems security expert Pradeep Kadambar breaks them down: 144 agents to every human identity in cloud-native environments. Yet Kadambar insists that the answer is to be found in more AI – which he says is not not a magic button, but can be a “force multiplier for humans.”

“What AI can do is not change the process, but divide the problem into risk-based categorization,” he says. It can identify access patterns, surface violations and privilege combinations that manual reviews miss, improve role quality and – most crucially – offer “continuous visibility into governance health rather than a point-in-time snapshot.”

Indeed, Kadambar believes that AI can “completely reduce the problem set.” People may be redundant – at least in instances when scale makes human review practically impossible: Williams points to an organization RSA works with that has done “close to 52 million different entitlement reviews” – a number that no human staff would ever get through.

Continuous governance to replace point-in-time model

The grand takeaway is that if your identity governance model is leaking, it’s probably past its expiry date. Time to replace it with a model that monitors compliance in real time – which AI enables. Point-in-time governance must give way to what RSA calls “active defense governance.”

Williams defines this as a shift in the core question, from “who has access” to “why does this identity have this access, right now?” A static identifying credential does not answer the question of why an agent is doing what it’s doing, or who assigned it the task. In the new model, certifications still happen – but “they validate what continuous monitoring has already caught, not the other way round.”

That AI-assisted identity governance is now a necessity reflects the evolution of a tech sector that has bought into AI as a solution to everything. There is irony in deploying AI to manage the influx of agentic entities that has created so many new concerns for governance, access and compliance. Yet the scale of the problem demands a response that is beyond the scope of human capability, at least without assistance from machine learning. AI enables continuous governance – metaphorically, a steady supply of freshly-pressed olive oil straight from the source, to ensure its full integrity is preserved and that it always delivers the best results.

Article Topics

AI agents  |  authentication  |  authorization  |  identity governance  |  identity security  |  non-human identities  |  RSA